[hwasan] Check for overflow when searching candidates.

[fmayer]

Summary

If the fault address is at the boundary of memory regions, this could
cause us to segfault otherwise.

Ran test with old compiler_rt to make sure it fails.

[eugenis]

compiler-rt/lib/hwasan/hwasan_report.cpp

299

There is MemIsApp in hwasan_linux.cpp. Rename this one to MemIsShadow, and maybe move both definitions to hwasan_mapping.h.

300

kLowShadowEnd and kHighShadowEnd are inclusive - a bit unusual but consider that on 32-bit (in other sanitizers) ex. kHighMemEnd may be 0xffffffff, and kHighMemEnd+1 is not representable in uptr.

[fmayer]

Rename & move IsShadow(...)

[fmayer]

compiler-rt/lib/hwasan/hwasan_report.cpp

299

Left MemIsApp in the old place, as it uses a function defined in hwasan.h, which I guess is the reason it is there in the first place.

[eugenis]

LGTM

compiler-rt/lib/hwasan/hwasan_mapping.h

inline uptr ShadowToMem(uptr shadow_addr) {
   return (shadow_addr - GetShadowOffset()) << kShadowScale;
 }
 inline uptr MemToShadowSize(uptr size) {
   return size >> kShadowScale;
 }
 
 bool MemIsApp(uptr p);
 
+inline bool MemIsShadow(uptr p) {
+  return (kLowShadowStart <= p && p <= kLowShadowEnd) ||
+         (kHighShadowStart <= p && p <= kHighShadowEnd);
+}
+
 }  // namespace __hwasan
 
 #endif  // HWASAN_MAPPING_H

compiler-rt/lib/hwasan/hwasan_report.cpp

static uptr GetGlobalSizeFromDescriptor(uptr ptr) {
   for (const hwasan_global &global :
        HwasanGlobalsFor(load_bias, phdr_begin, ehdr->e_phnum))
     if (global.addr() <= ptr && ptr < global.addr() + global.size())
       return global.size();
 
   return 0;
 }
 
 static void ShowCandidate(uptr untagged_addr, tag_t *candidate, tag_t *left,
                           tag_t *right) {
   Decorator d;
   uptr mem = ShadowToMem(reinterpret_cast<uptr>(candidate));
   HwasanChunkView chunk = FindHeapChunkByAddress(mem);
   if (chunk.IsAllocated()) {
     uptr offset;
     const char *whence;
     if (untagged_addr < chunk.End() && untagged_addr >= chunk.Beg()) {
       offset = untagged_addr - chunk.Beg();
void PrintAddressDescription(
   // the shadow left and right and looking for the first adjacent
   // object with a different memory tag. If that tag matches addr_tag,
   // check the allocator if it has a live chunk there.
   tag_t addr_tag = GetTagFromPointer(tagged_addr);
   tag_t *tag_ptr = reinterpret_cast<tag_t*>(MemToShadow(untagged_addr));
   tag_t *candidate = nullptr, *left = tag_ptr, *right = tag_ptr;
   uptr candidate_distance = 0;
   for (; candidate_distance < 1000; candidate_distance++) {
-    if (TagsEqual(addr_tag, left)) {
+    if (MemIsShadow(reinterpret_cast<uptr>(left)) &&
+        TagsEqual(addr_tag, left)) {
       candidate = left;
       break;
     }
     --left;
-    if (TagsEqual(addr_tag, right)) {
+    if (MemIsShadow(reinterpret_cast<uptr>(right)) &&
+        TagsEqual(addr_tag, right)) {
       candidate = right;
       break;
     }
     ++right;
   }
 
   constexpr auto kCloseCandidateDistance = 1;
 

compiler-rt/test/hwasan/TestCases/tag-mismatch-border-address.c

+// Make sure we do not segfault when checking an address close to kLowMemEnd.
+// RUN: %clang_hwasan  %s -o %t
+// RUN: not %run %t 2>&1 | FileCheck %s --check-prefix=CHECK
+
+// REQUIRES: stable-runtime
+// REQUIRES: aarch64-target-arch
+
+#include <sanitizer/hwasan_interface.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/mman.h>
+
+static volatile char sink;
+extern void *__hwasan_shadow_memory_dynamic_address;
+
+int main(int argc, char **argv) {
+  void *high_addr = (char *)__hwasan_shadow_memory_dynamic_address - 0x1000;
+  void *r = mmap(high_addr, 4096, PROT_READ, MAP_FIXED | MAP_ANON | MAP_PRIVATE,
+                 -1, 0);
+  if (r == MAP_FAILED) {
+    fprintf(stderr, "Failed to mmap\n");
+    abort();
+  }
+  volatile char *x = (char *)__hwasan_tag_pointer(r, 4);
+  sink = *x;
+}
+
+// CHECK-NOT: Failed to mmap
+// CHECK-NOT: Segmentation fault
+// CHECK-NOT: SEGV